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The present invention relates to a network including a plurality of devices, each 
5 device being capable of wireless communication with the other devices of the 
networkj and to a method allowing selected devices within a nerworlrto-be 
associated within a domain. 

According to the present invention, there is provided a network including a 
10 plurality of devices, each device being capable of wireless communication with 
the other devices of the network, and wherein one of the devices includes 
administration means for allowing selected devices to be associated within a 
domain by providing each device with identification data, the identification data 
of each device being interpretable by each other device within the domain, 
15 particular modes of communication only being allowed between devices within 
the domain having such identification data. 

According to another aspect of the present invention, there is provided a method 
allowing selected devices within a network to be associated within a domain, 
20 each device being capable of wireless communication with the other devices of 

the domain, the method including adapting one Device Wmuu «. o 

provide each other device with identification data, the identification data of each 



♦ 

modes of communication only being allowed between devices within the domain 
having such identification data. 

For a better understanding of the present invention, embodiments will now be 
5 described by way of example, with reference to the accompanying drawings, in 
which: 

Figure 1 shows a personal area network (PAN) including a plurality of devices 
belonging to one user; 
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Figure 2 shows a personal area network (PAN) having two PAN Security 
Domains (PSDs) formed therein in accordance with the invention; 

Figure 3 shows the formation of a further PSD in the PAN of Figure 2; and 

Figure 4 shows the exchange of data between devices within a PSD. 



Figure 1 shows a personal area network (PAN) 1 including a plurality of devices 
belonging to one user. Within the PAN 1 it is desired that all the individual 
20 devices can communicate and share resources with other devices of the same 
user in seamless fashion. From a security standpoint, this requires individual 
devices to identify other devices owned by the same user when offering or 
requesting services. Further, in order to protect data confidentiality, individual 



devices should be able to communicate securely with each other. Depending on 
the number of devices within the PAN 1 and the services they offer, this can 
become very complicated. This problem is further complicated because the 
number of devices will be changing with time as devices join and leave the PAN 
5 1. 



A PAN is different from a conventional network in that communication between 
devices is not through a server. 

10 If such a multitude of devices in a PAN are expected to have coherent behaviour, 
all devices should be able to fit into a distributed terminal architecture capable of 
taking into consideration the ownership and privileges required for individual 
devices to operate. 

15 In Figure 1 the devices in the personal area network 1 comprise a GPRS mobile 
telephone 3, laptop computer 5 and personal digital assistant (PDA) device 7. As 
indicated by the arrows, each of the devices 3, 5, 7 is capable of communicating 
with the other devices within the PAN 1. In this example each of the devices 3, 5, 
7 is a Bluetooth device, allowing the devices 3, 5, 7 to be inter-operable. Data 

20 communication between the devices 3, 5, and 7 may be by infrared 
communication, radio communication or by any other wireless means. 



For example, the PDA 7 will connect to the mobile telephone 3 to access the 
Internet and to the laptop computer 5 to synchronise the user's calendar or to 
exchange files for other reasons. 

5 Conventionally, each pair of devices 3, 5 and 7 must be separately configured to 
communicate with each other. This will require three separate configuration 
processes, for example between the laptop 5 and the PDA 7, the laptop 5 and the 
mobile telephone 3 and the mobile telephone 3 and the PDA 7. After an initial 
configuration processes the devices 3, 5, 7 may communicate with one another, 

10 although typically this will require the user to manually select a communication 
mode on each of two devices to communicate with one another. The devices may 
be configured to require the user to enter a personal identification number (PIN) 
before data exchange between a pair of devices can begin in order to, for 
example, prevent an unwanted device being substituted for one of the devices 3, 

15 5 and 7 and obtaining or over-writing data from a device within the PAN 1 . 

In such a PAN 1, if it is desired to add a further device, such as MP3 player 9, it 
will be necessary to configure separately each of the devices 3, 5, 7 within the 
PAN 1 to communicate with the MP3 player 9. It will be appreciated that, as the 
20 number of devices within the PAN 1 increases, the addition of a new device to 
the PAN 1 requires an increasing number of configuration steps. For a 
conventional PAN having n components, n*{n.\)l2 component associations must 
be performed to form the PAN. 




According to an aspect of the invention a group of devices within a PAN form a 
PAN Security Domain (PSD). A PSD is a group of components inside a PAN 
where each component can be authenticated, trusted and securely communicated 
5 with by means of some common security association. This reduces the number 
of component association procedures required: 



In a PSD one device has the role of a PSD administrator. This device includes 
security data (for example a shared key or a public-private key pair) that can be 

10 selectively passed to other devices that are to join the PSD. Communication can 
only successfully occur between devices that have this security data. Once a 
device has the security data, it can communicate with other devices in the PSD 
without referring to the PSD administrator. When a device is added to the PSD 
the PSD administrator advises each device of the addition of a new device to the 

15 PSD. If there are n devices in the PSD this requires n-l inter-device 
communications. It is not necessary for the new device to separately pair or 
associate itself with each other device in the PSD. 



The security association could be in the form of a shared secret key or a shared 
group key based on public key techniques, with a mutual "trust" being 
established between the devices by a personal certification authority (CA) within 
the PSD. Certificates issued to all PSD members indicate the device as a member 

., r r~7Fi\t !■-££» - TH-: T-.iyrj k"27"fc~nr»t use=>for secure-bilateral- commuaicaJaoQSjn.- 



the PSD, which takes place using bilaterally established keys (discussed further 
1 below). The group key is used only for proof of PSD membership, secure PSD- 
wide broadcasts and PSD-wide secure communications. 



5 



The initial decision as to whether a device can be part of a PSD or not will be on 
user judgement followed up by positive authentication of the device based on a 
public key infrastructure (PKI) trusted root certificate. Alternatively, another 
known authentication method could be used. 



10 One device within the PSD is nominated as the PSD administrator. The PSD 
administrator is a role that could be assumed by any of the devices in the PSD 
provided it contains the necessary hardware to support the role, for example a 
secure key store and/or a display. The administrator role may be moved from one 
device to another. If the administrator role is moved to a new device, the new 

15 device will have passed thereto, or have pre-stored thereon, the necessary 
security data to allow the admission of new devices to the PSD. 

The PSD administrator also is responsible for configuring and managing the 
policies (described below) governing the devices in the PSD. Additionally it is 
20 responsible for enrolling new members in the PSD. The PSD administrator could 
also contain the personal CA that is responsible for issuing certificates to the 
PSD members. Advantageously, the PSD administrator will be the device with 



• • # 

the greatest processing power and the best user interface. In a PSD based on the 
PAN 1 of Figure 1, the administrator is laptop 5. 

I 

When a single user owns all devices in a PSD and treats them equally, such a 
5 configuration of devices will not contain any restrictions based on the identity of 
a device. All shared resources will be made available to all the PSD member 
devices. In other words, there is group "trust" between the devices. If a device is 
a member of the PSD, the other devices will assume that the devices can be 
trusted and communicated with. There is no need for each device to set up an 
10 individual trust relationship with each other device, in contrast to a conventional 
PAN as described above. Provided that the device is admitted to the group by 
the PSD administrator, the other devices will assume that the newly-admitted 
device can be trusted. 

15 Figure 2 illustrates a PAN 11 containing six devices, designated A to F. The 
devices shown in Figure 2 are all PDAs but it should be understood that they 
could be other types of device, or a combination of different devices, as in Figure 
1. Devices A, B and C are owned by the same user (user 1) while D and E are 
owned by another user (user 2). A third user (user 3) owns device F. All these 

20 devices are capable of communicating with other using their local interfaces. 

A first PSD 13 includes devices A, B and C. These devices will be able to share 

■ ".!■:•■=-. cad : ommunkoi: vith rxdb eihar -vciu-ilr - ?e:ond l'SD !5 Iiwtadsn 



8 

devices D and E. Again, these devices will be able to share resources and 
communicate with each other securely. 

If membership of one PSD is limited to devices, such as devices A, B and C, 
5 from a single user, two users will not be able share any resources. Sharing of 
resources could be achieved if the existing PSDs are configured so that device 
sharing between the PSDs is possible. 

A more effective and preferred way for the two users to share resources is to 
10 establish a new PSD. Depending on the situation, this PSD could be a temporary 
or a permanent PSD including the devices with the resources required to be 
shared. 

Figure 3 shows a new PSD 17 formed between devices B, C and E. This will 
15 require a security association between two devices belonging to users 1 and 2. 
This association does not have to be between the very same devices that are 
going to be part of the new PSD. The original PSD could transmit the necessary 
data to introduce the new device to the PSD to all its member devices. 
Alternatively, the users 1 and 2 could pair two devices (one from each user) and 
20 then add further devices as required using one of the original devices as the PSD 
administrator. 



• # 

When forming a PSD with devices from different users, it is not always 
straightforward to assign a PSD administrator. It might have to be mutually 
agreed by all parties in the PSD. Alternatively, the device that initially created 
the PSD could assume this role. Nevertheless, if required it could be handed over 
5 to another device in the PSD. 



Each user can then configure their device policies to share the required resources 
with the members of the newly formed PSD. 

10 User 1 will configure the policy on B and C while user 2 will do the same for E. 
Individual devices could contain a number of built in or preset configurations 
that could be activated by the user for different PSDs. 

If required a PSD could also be used to establish different groups within a set of 
1 5 devices owned by the same user. 

In addition to the temporary PSD between user 1 and user 2, either of them could 
establish another PSD to share resources with user 3. In order to keep the PSD 
concept simple, user 2 cannot use one of his devices, say E to establish a PSD 
20 between user 1 and 3, i.e. E cannot bridge the trust between the two different 
PSDs. Nonetheless, this could be achieved if E used as a PSD administrator to 
form a PSD involving devices from user 1 and user 3. 



The formation of a PSD between devices B, C and E, with identities IDB, IDC 
and IDE respectively, will now be described in more detail, with reference to 
Figure 4. In order for these devices to form a PSD, two security associations 
between the three devices are needed. For example, these could be {B, C} and 

5 {C, E}. Based on these associations, it is possible for B and C, and C and E to 
communicate securely. Device C performs the role of PSD administrator. C then 
generates a group PSD membership key KPSD. C then communicates the 
identities of all PSD members to each other, i.e. forwards IDB and IDE to E and 
B respectively. Together with KPSD, B and E are now in a position to generate a 

10 further key KBE to allow secure communications between them. Figure 4 of the 
drawings shows the exchange of data between devices. 

Alternatively, device C can have the role of a personal CA and issue B and E 
with certificates to carry out the above key exchanges using a local PKI. The 
15 possession of this certificate is equivalent to having access to KPSD, i.e. its proof 
of membership in the PSD. 

However, forming a PSD itself does not impose any behaviour patterns or rules 
on the individual devices themselves. These must be achieved through a suitable 
20 "policy". This policy will set guidelines on behaviour and dictate how resources 
should be used and how the device should behave under different circumstances. 



PSD policy can be used to enforce restrictions on any of the following: 
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a. Access to resources and their usage patters. 

b. Requirements for joining the PSD as a member. 

c. Requirements to assume the role of the PSD administrator. 
5 d. User interaction. 

e. Usage of chargeable services. 

f. Usage of user private information. 

Devices from more than one user may be PSD members. 

10 

The PSD policy file is in a standardised format to achieve interoperability 
between devices and it contains information about the resources available to 
different devices depending on the PSD to which they belong. All the resources 
listed in the file do not have to be available to the PSD all the time. These entries 
1 5 can be for future use when the resource is available to the PSD. 

Each device has its own version of the policy file that states which resources are 
available from that particular device to the rest of the PSD members. Hence the 
policy file for two devices with different resource commitments to the PSD will 
20 differ. Devices may update or modify this as and when resources are either added 
to the PSD or removed from the PSD. Alternatively, the device might rely on the 
PSD administrator to do this on the device's behalf. 
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Depending on the access control mechanism it might be required to the store the 
policy file locally on a device. Nevertheless it is possible for a device to enquire 
and obtain policy information from a trusted device. It is not required for this 
trusted device to be a member of the same PSD. 



The significance of each entry in a device policy is explained below. 



Resource Type & ID 



GPRS 



Target ID 



Authorisation ID 



Permission Type 



Component 



Validity 



1 day 



An Example PSD Policy File 

Resource Type & H) 
10 This contains information about the ID of the resource and its type. The ID is 
required to uniquely identify the resource within a component. The type of the 
resource is important when enforcing "Permissions Types" (discussed below) 
applicable to a resource. 

15 Different resources on a component can be divided into four broad functional 
areas depending on their impact on the hosting component and its user. 



1 . Local Services - Printers, projectors, etc. 



» 13 # 

2. Network Interfaces - GSM, GPRS, BT, IrDA, WLAN, etc., or similar 
resources related network connectivity 

3. Personal Information Management - Calendar, Phonebook, Location 
information etc., which are of personal value and will have privacy issues 
associated with them. 

-qr Kxecutables - refers to code^wnl'oaded^roTn-anT?tfer-component-on-to 

the target device. 
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The above is merely an example of resources. 
Target ID 

Uniquely identifies the component where the resource is located. It is useful to 
identify resources within the PSD when the resource is available from more than 
one component in the PSD. 



Authorisation ID 

PSD members have access to all PSD resources that have been made available by 
the policy file. If the PSD relies on a PSD administrator, then the Authorisation 
ID should be the ID of the component assuming the role of the PSD 
20 administrator. If the component is to have the autonomy to authorise other 
components access to its resources, then the Authorisation ID is the same as the 
Target ID. When there are devices from more than one user, it is likely that the 



devices will retain the ability to authorise themselves without having to rely on a 
PSD administrator. 

Permission Types 

5 The permission types that are made available to different components depend on 
the resource type and other considerations. In order to cater for different usage 
scenarios and patterns there are different permissions types depending on the 
type of the resource. 

Component - Will use the targeted component's default access control 
rules applicable for a component of given trust level. The component's 
local security policy is consulted when making the access control the 
decision. 

User - Will prompt the user to grant permission from a range of 
permissions types available for a device of that trust level. 
Allowed - The indicated resource is given access to the resource until 
further notice 



10 a. 



b. 

15 



Furthermore, if the selected permissions type is "user", the PSD policy 
20 should contain a user permission type. 
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Validity 

Contains infonnation on validity periods for which a request can be granted to 
components of various trust levels. 

5 Each device within a PSD may be equally trusted, i.e. all devices within a PSD 

wiU-have^GGess^o-me^ame4nfonnation^Altematb 

may have different "privileges", that is one device may be able to access 
information that another device within the PSD is prevented from accessing. For 
example, a PSD may include two personal computers, PC A and PC B. These 

10 personal computers could be configured so that only PC A has access to the PSD 
user's e-mails (which could be stored on PC A or elsewhere). Such restrictions 
(or privileges) to the access of information within the PSD could be held on the 
policy file for that PSD). It is preferred that the restrictions or privileges can be 
changed within a PSD, as required. This will typically be performed under 

15 control of the PSD administrator. 



The advantages of a PSD include: 

* It is not necessary for a new PSD member to share security associations 
with all existing PSD members to establish trusted communications with 
20 them. For example, if device D joins an existing PSD of A, B and C, 

which is defined by group key, KABC. Once D has been authenticated by 
A (the PSD administrator), and a bilateral communication key KAD 
essaMshed,^. .can-send K ABC ho Dander the protection of key KAD". D 
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can then prove PSD membership with this and establish further bilateral 
secure communication keys with B and C. 

Reduction in the user interaction required as the number of imprinting 
events is reduced. For a PSD of n components, only n-1 imprinting 
sessions are necessary, compared to n(n-l)/2 in a conventional PAN 
without the PSD concept 

Use of the device with the best user interface for the PSD administrator 
for enrolling new members allows the most user friendly imprinting 
protocols to always be used 

Use of a PSD administrator with revocation checking facilities allows 
revocation checks to be performed when new devices with certificates are 
enrolled 

Consistent resource information across all devices 

Resources can be shared with other users without having to compromise 

interactions between one's own devices 

Designation of group roles: 

o Designation of a single device to perform the role of a gateway 

between all PSD devices and external devices. 

o Designation of devices to perform specialised tasks, for example 

calendar synchronisation, revocation checking 
Use of the shared security associations to perform secure broadcast 
A device can be nominated by the user to perform administrative tasks on 
his behalf, i.e. the PSD administrator 



* Establishes another layer of security on top of link layer security 

* Different PSDs can be created for different trust groups within a PAN to 
solve particular access control problems. 

5 The PSD concept described above is applicable to networks other than PANs. 
The devices in the network (an<rdwain)^ 

Devices could be manufactured or pre-configured to enrol in certain PSDs 
automatically. For example, a mobile telephone could be configured so that 
.0 when it comes within communication range of a particular PSD it automatically 
enrols in that PSD. Where such automatic enrolment is provided, generally the 
exchange of data between devices in the PSD will be restricted to prevent private 
information being disclosed to other devices in the PSD. 

15 For example, a PSD could be arranged by a train operating company that 
automatically enrolled appropriately programmed mobile telephones at a station 
so that train running information can be transmitted to the telephone for use by 
the user. 
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CLAIMS 

A network including a plurality of devices, each device being capable 
of wireless communication with the other devices of the network, and 
wherein one of the devices includes administration means for allowing 
selected devices to be associated within a domain by providing each 
device with identification data, the identification data of each device 
being interpretable by each other device within the domain, particular 
modes of communication only being allowed between devices within 
the domain having such identification data. 

The network of claim 1, wherein the identification data received from 
the administration means includes a key. 

The network of claim 2, wherein the key is a shared key. 

The network of claim 2, wherein the key is a public key of a public- 
private key pair, the private key being stored on the administration 
means. 

The network of any one of claims 1 to 4, wherein each device has a 
security certificate associated therewith indicating its membership of 
the domain. 
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The network of any one of claims 2 to 5, including further keys for 
allowing encrypted communication between the devices within the 
domain. 

ieTietwgr k of any one-of^atms-l-te^wher&in^e^dniinistratiQn 

means transmits to each device within the domain data indicative of 
the characteristics of the other devices within the domain. 

The network of any one of claims 1 to 7, wherein the administration 
means is transferable form one device to another. 

The network of any one of claims 1 to 7, wherein a plurality of devices 
within the domain include administration means, and means is 
provided to selectively enable only one of said administration means at 
a time. 

The network of any one of claims 1 to 9, including a plurality of said 
domains. 

^ network of claim io, wherein a device is associated with each of 
said plurality of domains. 
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12. A network substantially as hereinbefore described and/or substantially 
as illustrated in any one of or any combination of the accompanying 
drawings. 



5 13. A method allowing selected devices within a network to be associated 
within a domain, each device being capable of wireless communication 
with the other devices of the domain, the method including adapting 
one device within the domain to provide each other device with 
identification data, the identification data of each device being 
10 interpretable by each other device within the domain, particular modes 

of communication only being allowed between devices within the 
domain having such identification data. 



15 
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14. The method of claim 13, wherein the identification data includes a key. 

15. The method of claim 14, wherein the key is a shared key. 

16. The method of claim 14, wherein the key is a public key of a public- 
private key pair, the private key being stored on the adapted device. 

17. The method of any one of claims 13 to 16, wherein each device has a 
security certificate associated therewith indicating its membership of 
the domain. 
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18. The method of any one of claims 14 to 17, including providing further 
keys for allowing encrypted communication between the devices 
within the domain. 



T9; TterireraTri-Kjf^ny^n^ 



transmits to each device within the domain data indicative of the 
characteristics of the other devices within the domain. 

20. The method of any one of claims 13 to 19, including changing the 
device within the domain which provides each other device with 
identification data. 

21. The method of any one of claims 13 to 20, including allowing the 
formation of a plurality of said domains. 



22. 



23. 



The method of claim 21, wherein a device is associated with each of 
said plurality of domains. 

A method substantially as hereinbefore described and/or substantially 
as illustrats d in any one of or any combination of the accompanying 
drawings. 
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ABSTRACT 
NETWORKS • 

A network 11 including a plurality of devices A...F, each device being 
capable of wireless communication with the other devices of the network. 
One of the devices C includes administration means for allowing selected 
devices A,B,C to be associated within a domain 13 by providing each device 
A,B,C with identification data, the identification data of each device being 
interpretable by each other device within the domain, communication only 
being allowed between devices within the domain having such identification 
data. 



[ Figure 3 ] 



